New ISO Standard for Internal Investigations

In July 2023, the International Organization for Standardization (ISO) published the ISO 37008, which provides new guidance for internal investigations of organizations. The released standard is aimed at all organizations, regardless of type, size, location, structure, or purpose; and it is intended to be tailored to meet each organization’s needs, causing the necessary adjustments to each corporate compliance management system.

This guidance seeks to provide organizations with a useful tool to conduct internal investigations based on the following five key principles: independence; confidentiality; competence and professionality; objective and impartial and, finally, legality and lawfulness. Following such principles may allow organizations to achieve more robust investigations that can better stand up to scrutiny (e.g., from public authorities if the case is later reported).

The ISO 37008 addresses the full cycle of an internal investigation system, not only covering the design and implementation of corporate investigative protocols, processes, and policies, but also describing the steps to follow during the pre-investigation stage, the actual investigation stage, and the post-investigation stage (e.g., reporting and remediation actions).

The guide highlights the importance of the preparatory efforts to reach a successful investigation conclusion. The guide emphasizes the preparation of an investigation plan that outlines the investigative team members and the scope of the investigation. Preserving evidence is also emphasized as crucial for this kind of fact-finding exercises.

Further, this new ISO stresses the relevance of management support to achieve an effective internal investigation. Such support may be shown through sufficient resources allocated for the investigation and demonstration of the management’s commitment to following the key principles that should inspire investigations.

The release of the ISO 37008 will most likely have a practical impact on the internal investigations being conducted. It may also prompt companies to review their internal investigations protocols and procedures to be up to this global standard.

Finally, if there is no specific regulation, government authorities could use it as a benchmark in evaluating internal investigations, as an exemption or mitigating factor.